[PATCH v2 1/3] virtiofs: Complete no-reply virtio requests without parsing the out header

[Li Wang]

FUSE requests that do not set FR_ISREPLY never map fuse_out_header or reply
payload into the virtqueue in virtio_fs_enqueue_req(). For example,
for the FORGET requests sent in fuse_force_forget(), req->out.h.len is 
initialized to 0 in fuse_request_alloc(). On completion, copy_args_from_argbuf() 
must not run: it subtracts sizeof(fuse_out_header) from req->out.h.len, 
which will cause an underflow.

Always free the bounce buffer allocated by copy_args_to_argbuf() on the
no-reply path so virtio_fs_enqueue_req() does not leak argbuf.

In virtio_fs_requests_done_work(), only call virtio_fs_verify_response()
when FR_ISREPLY is set.

Signed-off-by: Li Wang <liwang@xxxxxxxxxx>
---
 fs/fuse/virtio_fs.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 2f7485ffac52..670dd413873b 100644
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -789,7 +789,13 @@ static void virtio_fs_request_complete(struct fuse_req *req,
 	struct folio *folio;
 
 	args = req->args;
-	copy_args_from_argbuf(args, req);
+	if (test_bit(FR_ISREPLY, &req->flags))
+		copy_args_from_argbuf(args, req);
+	else if (req->argbuf) {
+		/* Bounce buffer from virtio_fs_enqueue_req(); no reply payload to copy */
+		kfree(req->argbuf);
+		req->argbuf = NULL;
+	}
 
 	if (args->out_pages && args->page_zeroing) {
 		len = args->out_args[args->out_numargs - 1].size;
@@ -841,9 +847,11 @@ static void virtio_fs_requests_done_work(struct work_struct *work)
 		virtqueue_disable_cb(vq);
 
 		while ((req = virtqueue_get_buf(vq, &len)) != NULL) {
-			if (!virtio_fs_verify_response(req, len)) {
-				req->out.h.error = -EIO;
-				req->out.h.len = sizeof(struct fuse_out_header);
+			if (test_bit(FR_ISREPLY, &req->flags)) {
+				if (!virtio_fs_verify_response(req, len)) {
+					req->out.h.error = -EIO;
+					req->out.h.len = sizeof(struct fuse_out_header);
+				}
 			}
 			spin_lock(&fpq->lock);
 			list_move_tail(&req->list, &reqs);
-- 
2.34.1